CVE-2026-82261

SvelteKit @sveltejs/kit versions =2.49.0 and =2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in...